Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Proper handling of slow-loris mitigation. #33440

Closed
ebikt opened this issue May 16, 2020 · 0 comments · Fixed by #41263
Closed

Proper handling of slow-loris mitigation. #33440

ebikt opened this issue May 16, 2020 · 0 comments · Fixed by #41263
Labels
http Issues or PRs related to the http subsystem.

Comments

@ebikt
Copy link

ebikt commented May 16, 2020

Is your feature request related to a problem? Please describe.
Bug Regression in idle socket handling #24980 may be prevented for all timeout settings, if slow-loris mitigation (eb43bc0) was done properly, and client was notified about server.headersTimeout expiration by closing or discarding the socket.

Describe the solution you'd like
Currently the timeout is passive, i.e., resolved on next event (which may be minutes later, depending on configuration). I propose active timeout event instead, i.e., closing/discarding the connection on timeout expiration. That would send RST or FIN packet to the client and it would also free the resources allocated to the connection.

Describe alternatives you've considered
Is there any? In fact, in rare circumstances the client may ask at the exact time the timeout expires, leading to current behaviour. This is not ideal, but various rare networking and server errors would have comparable probability, thus proper documentation should be sufficient here.
Also I have not tested that ELB would react properly on this solution. But current behaviour is misleading to many IT engineers, as the timeout does not manifest itself immediately, rather it appears as a bug in server/application implementation.

@lpinca lpinca added the http Issues or PRs related to the http subsystem. label May 20, 2020
ShogunPanda added a commit to ShogunPanda/node that referenced this issue Dec 21, 2021
ShogunPanda added a commit to ShogunPanda/node that referenced this issue Jan 11, 2022
ShogunPanda added a commit to ShogunPanda/node that referenced this issue Jan 15, 2022
ShogunPanda added a commit to ShogunPanda/node that referenced this issue Jan 31, 2022
ShogunPanda added a commit to ShogunPanda/node that referenced this issue Mar 7, 2022
ShogunPanda added a commit to ShogunPanda/node that referenced this issue Mar 18, 2022
nodejs-github-bot pushed a commit that referenced this issue Apr 13, 2022
PR-URL: #41263
Fixes: #33440
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Darshan Sen <raisinten@gmail.com>
vmoroz pushed a commit to vmoroz/node that referenced this issue Apr 13, 2022
PR-URL: nodejs#41263
Fixes: nodejs#33440
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Darshan Sen <raisinten@gmail.com>
xtx1130 pushed a commit to xtx1130/node that referenced this issue Apr 25, 2022
PR-URL: nodejs#41263
Fixes: nodejs#33440
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Darshan Sen <raisinten@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
http Issues or PRs related to the http subsystem.
Projects
None yet
2 participants